829dad515d4304be0198e207f3143f875a06c81d9302f10d432530c2308344ec

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
28-06-2024 00:41

Target

1827de680f27186c9cf27bcd613f9b8b_JaffaCakes118.dll
Size

6KB
MD5

1827de680f27186c9cf27bcd613f9b8b
SHA1

5562a6975f72bce2840c804699023240837b2cc0
SHA256

829dad515d4304be0198e207f3143f875a06c81d9302f10d432530c2308344ec
SHA512

3dbe1cb81dc205e887e206e031c05e44d4014114a2691246deccfc2b6cf794b785ae0ab0eb7b462e0caec03c588f5ea6c082b00ae7042af020d1b1d233648ebe
SSDEEP

48:aGy7MN4cpSGAXbIni1kvNs6ztutiKIZWiwQTnU5WwG2QozbC:xB4c4G6bn1k1sw0EW3enIWwGqb

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 2952	3252	rundll32.exe	82
PID 3252 wrote to memory of 2952	3252	rundll32.exe	82
PID 3252 wrote to memory of 2952	3252	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1827de680f27186c9cf27bcd613f9b8b_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3252
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1827de680f27186c9cf27bcd613f9b8b_JaffaCakes118.dll,#1
  2⤵
  PID:2952

memory/2952-0-0x0000000001220000-0x0000000001226000-memory.dmp

Filesize
24KB

Download